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There has been much interest in quantum key distribution. Experimentally, quantum key distri- 
bution over 150 km of commercial Telecom fibers has been successfully performed. The crucial issue 
in quantum key distribution is its security. Unfortunately, all recent experiments are, in principle, 
insecure due to real-life imperfections. Here, we propose a method that can for the first time make 
most of those experiments secure by using essentially the same hardware. Our method is to use 
decoy states to detect eavesdropping attacks. As a consequence, we have the best of both worlds — 
enjoying unconditional security guaranteed by the fundamental laws of physics and yet dramatically 
surpassing even some of the best experimental performances reported in the literature. 
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Quantum key distribution (QKD) allows two users, Al- 
ice and Bob, to communicate in absolute security in the 
presence of an eavesdropper, Eve. Unlike conventional 
cryptography, the security of QKD is based on the fun- 
damental laws of physics, rather than unproven compu- 
tational assumptions. The security of QKD has been rig- 
orously proven in a number of recent papers . See also 
0. There has been tremendous interest in experimental 
QKD Hi, with the current world record distance of 150 
km of Telecom fibers 

Unfortunately, all those exciting recent experiments 
are, in principle, insecure due to real-life imperfections. 
More concretely, highly attenuated lasers are often used 
as sources. But, these sources sometimes produce signals 
that contain more than one photons. Those multi-photon 
signals open the door to powerful new eavesdropping at- 
tacks including photon splitting attack. For example, 
Eve can, in principle, measure the photon number of each 
signal emitted by Alice and selectively suppress single- 
photon signals. She splits multi-photon signals, keeping 
one copy for herself and sending one copy to Bob. Now, 
since Eve has an identical copy of what Bob possesses, 
the unconditional security of QKD (in, for example, stan- 
dard BB84 protocol 5j) is completely compromised. 

In summary, in standard BB84 protocol, only signals 
originated from single photon pulses emitted by Alice 
are guaranteed to be secure. Consequently, paraphrasing 
GLLP , the secure key generation rate (per signal state 
emitted by Alice) can be shown to be given by: 



S > Q^{-H 2 {E^) + fi[l - fla(ei)]} 



(1) 



where and are respectively the gain and quantum 
bit error rate (QBER) of the signal state Q, ^ and e\ are 
respectively the fraction and QBER of detection events 
by Bob that have originated from single-photon signals 
emitted by Alice and H% is the binary Shannon entropy. 

It is a priori very hard to obtain a good lower bound 
on CI and a good upper bound on e±. Therefore, prior 



art methods (as in GLLP make the most pessimistic 
assumption that all multi-photon signals emitted by Alice 
will be received by Bob. For this reason, until now, it has 
been widely believed that the demand for unconditional 
security will severe ly r educe the performance of QKD 
systems [H [ll| . 

In this paper, we present a simple method that will pro- 
vide very good bounds to Q and e\. Consequently, our 
method for the first time makes most of the long distance 
QKD experiments reported in the literature uncondition- 
ally secure. Our method has the advantage that it can be 
implemented with essentially the current hardware. So, 
unlike prior art solutions based on single-photon sources, 
our method does not require daunting experimental de- 
velopments. Our method is based on the decoy state idea 
first proposed by Hwang 01 • While the idea of Hwang 
was highly innovative, his security analysis was heuris- 
tic. The key point of the decoy state idea is that Alice 
prepares a set of additional states — decoy states, in ad- 
dition to standard BB84 states. Those decoy states are 
used for the purpose of detecting eavesdropping attacks 
only, whereas the standard BB84 states are used for key 
generation only. The only difference between the decoy 
state and the standard BB84 states is their intensities 
(i.e., their photon number distributions). 

By measuring the yields and QBER of decoy states, we 
will show that Alice and Bob can obtain reliable bounds 
to O and e±, thus allowing them to surpass all prior art 
results substantially [13. Here, we give for the first time 
a rigorous analysis of the security of decoy state QKD. 
Moreover, we show that the decoy state idea can be com- 
bined with the prior art GLLP |(| analysis. 

Preliminar y v ersions of our result in this paper have 
appeared in |14L Il5j . where we presented not only the 
general theory, but also proposed the idea of using only a 
few decoy states (for example, three states — the vacuum, 
a weak decoy state with fidecoy <C 1 and a signal state 
with /j, = 0(1). We call this a Vacuum+Weak decoy state 
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protocol). Subsequently, our protocols for decoy state 
QKD have been analyzed in |16| and more systematically 
in . See also 0] . Recently, we have provided the first 
experimental demonstration of decoy state QKD in [T^| . 

We now present the general theory of our new decoy 
state schemes. We will assume that Alice can prepare 
phase-randomized coherent states and can turn her power 
up and down for each signal. This may be achieved by 
using standard commercial variable optical attenuators 
(VOAs) [2(j. Let \ y JJie ie ) denote a weak coherent state 
emitted by Alice. Assuming that the phase, 8, of all 
signals is totally randomized, the probability distribution 
for the number of photons of the signal state follows a 
Poisson distribution with some parameter ji. That is 
to say that, with a probability p n = e _A1 /i™/n!, Alice's 
signal will have n photons. In summary, we have assumed 
that Alice can prepare any Poissonian (with parameter 
fi) mixture of photon number states and, moreover, Alice 
can vary the parameter, /i, for each individual signal. 

Let us consider the gain for a coherent state 
ly/JJe 19 ). [Here and thereafter, we actually mean the ran- 
dom mixture of \y/Jle ie } over all values of 8 as the phase 
is assumed to be totally randomized.] We have: 

Qn = Y Q e-^ + Y 1 e-^i + Y 2 e-"( f i 2 /2) 

+ ... + y n e-"(p n /n!) + ... (2) 

where Y n is the yield of an n-photon signal |2l| and where 
> gives the detection events due to background 
including dark counts and stray light from timing pulses. 

Similarly, the QBER can depend on the photon num- 
ber. Let us define e„ as the QBER of an n-photon signal. 
The QBER for a coherent state \^fjle' ie ) is given by 

QfiEp = Y e-^e + Y 1 e- fl t ie 1 +Y 2 e- fl (iJ 2 /2)e2 

+ ... + Y n e-»(p n /nl)e n + ..., (3) 

which is the weighted average of the QBERs of various 
photon number eigenstates. 

Essence of the decoy state idea Let us imagine that a 
decoy state and a signal state have the same character- 
istics (wavelength, timing information, etc). Therefore, 
Eve cannot distinguish a decoy state from a signal state 
and the only piece of information available to Eve is the 
number of photons in a signal. Therefore, the yield, Y n , 
and QBER, e„, can depend on only the photon number, 
n, but not which distribution (decoy or signal) the state 
is from. We emphasize that the essence of the decoy state 
idea can be summarized by the following two equations: 

Y n (signal) = Y n (decoy)=Y n (4) 
e n (signal) = e n {decoy) — e n . (5) 

While a few decoy states are sufficient, for ease of dis- 
cussion, we will for the moment consider the case where 
Alice will pick an infinite number of possible intensities 
for decoy states. Let us imagine that Alice varies over all 
non-negative values of /x randomly and independently for 



each signal, Alice and Bob can experimentally measure 
the yield and the QBER E^. Since the relations be- 
tween the variables Q^s and Y n 's and between E^s and 
e„'s are linear, given the set of variables Q^s and E^s 
measured from their experiments, Alice and Bob can de- 
duce mathematically with high confidence the variables 
Y n 's and e„'s. This means that Alice and Bob can con- 
strain simultaneously the yields, Y n and QBER e„ simul- 
taneously for all n. Suppose Alice and Bob know their 
channel property well. Then, they know what range of 
values of Y n 's and e ra 's is acceptable. Any attack by Eve 
that will change the value of any one of the Y n 's and e ra 's 
substantially will, in principle, be caught with high prob- 
ability by our decoy state method. Therefore, in order 
to avoid being detected, the eavesdropper, Eve, has very 
limited options in her eavesdropping attack. In summary, 
the ability for Alice and Bob to verify experimentally the 
values of Y n and e n 's in the decoy state method greatly 
strengthens their power in detecting eavesdropping, thus 
leading to a dramatic improvement in the performance 
of their QKD system. 

The decoy state method allows Alice and Bob to detect 
deviations from the normal behavior due to eavesdrop- 
ping attacks. Therefore, in what follows, we will consider 
normal behavior (i.e., the case of no eavesdropping). De- 
tails of QKD set-up model can be seen in [17| • 

Yield Let us discuss the yields, Y n 's, in a realistic 
set-up. 

(a) The case n = 0. 

In the absence of eavesdropping, Yq is simply given by 
the background detection event rate Pdark of the system. 

(b) The case n > 1. For n > 1, yield Y n comes from 
two sources, i) the detection of signal photons r) n , and 
ii) the background event Pdark- The combination gives, 
assuming the independence of background and signal de- 
tection events, 

Y n Tj n -\- Pdark 7]n ' Pdark 

~ Vn + Pdark (6) 

where in the second line we neglect the cross term because 
the background rate (typically 10 -5 ) and transmission 
efficiency (typically 10~ 3 ) are both very small. 

Suppose the overall transmission probability of each 
photon is r\. In a normal channel, it is common to as- 
sume independence between the behaviors of the n pho- 
tons. Therefore, the transmission efficiency for n-photon 
signals rj n is given by: 

i) n = 1 - (1 - 7?)", (7) 

[For a small r] and ignore the dark count, Y n « nrj.] 

QBER Let us discuss the QBERs, e n 's, in a realistic 
experiment. 

(a) If the signal is a vacuum, Bob's detection is due 
to background including dark counts and stray light due 
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to timing pulses. Assuming that the two detectors have 
equal background event rates, then the output is totally 
random and the error rate is 50%. That is, the QBER 
for the vacuum eo = 1/2. 

(b) If the signal has n > 1 photons, it also has some 
error rate, say e n . 

More concretely, e n comes from two parts, erroneous 
detections and background contribution, 
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&n — {cdetector ' Tjn ^P dark) j Y n ^ 



(8) 



where edetector is independent of n. 

The values of Y n and e n can be experimentally verified 
by Alice and Bob using our decoy state method. Any 
attempt by Eve to change them significantly will almost 
always be caught. 

Combining decoy state idea with GLLP Suppose key 
generation is done on signal state \^/Jle l9 ). In principle, 
Alice and Bob can isolate the single-photon signals and 
apply privacy amplification to them only. Therefore, gen- 
eralizing the work in GLLP, we find Eq. JIJ where the 
gain of the signal state, Q M = J2kLo ^ e_AI (mV^O > [This 
comes directly from Eq. (2).] and the fraction of Bob's 
detection events that have originated from single-photon 
signals emitted by Alice is given by: 



where 



Yx ■ fie->* 



(9) 



(10) 



is the gain for the single photon state. 

The derivation of Eq. Q assumes that error correction 
protocols can achieve the fundamental (Shannon) limit. 
However, practical error correction protocols are gener- 
ally inefficient. As noted in [23], a simple way to take 
this inefficiency into account is to introduce a function, 
/(e) > 1, of the QBER, e. By doing so, we find that the 
key generation rate for practical protocols is given by: 

S > q{-Qn.f{E^)H 2 {E^) + Qr[l - H 2 ( ei )}}, (11) 

where q depends on the implementation (1/2 for the 
BB84 protocol, because half the time Alice and Bob bases 
are not compatible, and if we use the efficient BB84 pro- 
tocol |2^| , we can have q w 1 . For simplicity, we will take 
q = 1 in this paper.), and /(e) is the error correction 
efficiency j2^]. 

Let us now compare our result in Eq. 1)111) with the 
prior art GLLP result. In the prior art GLLP 0] method, 
secure key generation rate is shown to be at least 



S^Qpi-H-iiEJ+n 



(12) 



where f2, the fraction of "untagged" photons, (which is a 
pessimistic estimation of the fraction of detection events 
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FIG. 1: This figure is obtained by writing a simple program. 
The line of GLLP without decoy state uses the formula 1)12)1 
and GLLP+Decoy uses the formul a! lit according to the pa- 
rameters given in experiment GYS [jj. With decoy states, the 
maximal distance increases to over 140 km. For comparison, 
we found that with prior art method, the secure distance is 
only about 30 km. We have also proven that an upper bound 
of distance of secure BB84 with the GYS parameters is 208 
km because this corresponds to the point where e\ = 1/4 and 
the protocol is insecure due to an intercept-resend attack. We 
have checked that our results are stable to small perturbations 
to the background event rate pdark and average photon num- 
ber p (both up to 20% change). 



by Bob that have originated from single-photon signals 
emitted by Alice), is given by 



1 — O — Pmulti/Qf, 



(13) 



where p mu iu is the probability of Alice's emitting a multi- 
photon signal. Eq. (|13|l represents the worst situation 
where all the multi-photons emitted by Alice will be re- 
ceived by Bob. 

Comparing our result (given in Eq. 1)110) with the 
prior art GLLP result (given in Eq. 1)12)1 L we see that 
the main difference is that in our result, a much better 
lower bound on fl and a much better upper bound on ei 
can be obtained. 

Implication of our result We obtain substantially 
higher key generation rate than in 0. In more detail, 
note that, from Eq. ©, Y n for n > 2 is of similar order 
to Y\. Therefore, from Eq. 1)11)1 it is now advantageous 
for Alice to pick the average photon number in her signal 
state to be /i = 0(1). Therefore, the key generation rate 
in our new method is O(rj) where rj is the overall trans- 
mission probability of the channel. In comparison, in 
prior art methods for secure QKD, /i is chosen to be of or- 
der 0(rj), thus giving a net key generation rate of 0(i] 2 ). 
In summary, we have achieved a substantial increase in 
net key generation rate from 0(rj 2 ) to 0(n). Moreover, as 
will be discussed below, our decoy state method allows 
secure QKD at much longer distances than previously 
thought possible. 
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More concretely, we [l5j have applied our results to 
various experiments in the literature. The results are 
shown in Fig. 1 using the GYS Q experiment as an ex- 
ample. We found that the optimal averaged number \x in 
GYS that maximizes the key generation rate in our decoy 
state method in Eq. ifTT)) is, indeed, of 0(1) (roughly 0.5). 
Therefore, the key generation rate is of order 0(rf). We 
remark that the calculated optimal value of photon num- 
ber of 0.5 is, in fact, higher than what experimentalists 
have been using. Experimentalists often liberally pick 
0.1 as a convenient number for average photon number 
without any security justification. In other words, oper- 
ating their equipment with the parameters proposed in 
the present paper will allow experimentalists to not only 
match, but also surpass their current experimental per- 
formance (by having at least five-fold the current exper- 
imental key generation rate). This demonstrates clearly 
the power of decoy state QKD. Moreover, Fig. 1 shows 
that with our decoy state idea, secure QKD can be done 



at distances over 140 km with only current technology. 

In summary, our result shows that we can have the best 
of both worlds: Enjoy both unconditional security and 
record-breaking experimental performance. The general 
principle of decoy state QKD developed here can have 
widespread applications in other set-ups (e.g. open-air 
QKD or QKD with other photon sources) and to multi- 
party quantum cryptographic protocols such as |2J|. As 
demonstrated clearly in |l7|. one can achieve almost all 
the benefits of our decoy state method with only one 
or two decoy states. See also ^(J. Recently, we have 
experimentally demonstrated decoy state QKD in [l9|. 
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